Firebase Cloud Messaging (FCM) sends device and messaging data to Google LLC. FCM registers each install with Google's servers and routes your notifications through them, which is a third-party data transfer you must disclose. Generate a full privacy policy with this clause built in →
Does Firebase Cloud Messaging (FCM) need a privacy policy disclosure?
FCM is Google's push-notification transport for Android, Apple platforms, and web. When your app starts, the SDK contacts Google and receives an FCM registration token — a string that uniquely identifies that app installation on that device. On Apple platforms FCM takes the APNs token from Apple and associates it with a Firebase installation ID to produce the FCM token. To deliver a notification, your server (or the Firebase console) sends the message to Google, Google looks up the token, and forwards the payload to the device. For topic messaging, the SDK also sends device model, language, time zone, OS version, and app version and identifier.
The registration token is a device identifier held by Google, and every message you send passes through Google's infrastructure. That makes FCM a transfer of personal data to a third party, with Google acting as your data processor under the Firebase Data Processing Terms. FCM is not an advertising SDK and does not read the advertising identifier, so it does not trigger Apple's App Tracking Transparency prompt on its own. Message payloads are processed transiently to deliver the notification and are not retained by Google unless you enable the BigQuery message-delivery export; the token itself is stored until the app is uninstalled or the token is refreshed or deleted.
What data does Firebase Cloud Messaging (FCM) collect?
| Data type | Purpose | Linked to the user? | Used for tracking? |
|---|---|---|---|
| FCM registration token (derived from the APNs token and a Firebase installation ID on Apple platforms) | Address messages to this install | Only if you store it against a user account | No |
| Device model, OS version, app version and identifier | Deliver messages, manage topic subscriptions | No | No |
| Language, time zone | Topic subscription management | No | No |
| Message payload (in transit) | Deliver the notification | Depends what you put in it | No |
| Notification open / dismiss events (requires Google Analytics) | Messaging analytics | No | No |
| Message delivery data (only if the BigQuery export is enabled) | Delivery reporting | No | No |
The exact list depends on the developer's configuration and enabled features: the token is always collected, but everything else depends on whether you use topic messaging, link Analytics, enable the BigQuery delivery export, or place personal data in payloads.
Copy-paste privacy policy clause for Firebase Cloud Messaging (FCM)
Push notifications (Firebase Cloud Messaging). This app uses Firebase Cloud
Messaging, a service provided by Google LLC, to deliver push notifications.
When you install the app, the service generates a registration token that
identifies your app installation and, on Apple devices, is derived from the
Apple Push Notification service token. We and Google use this token, together
with basic device information such as device model, operating system version,
app version, language, and time zone, to route notifications to your device
and to manage topic subscriptions. Notification content is transmitted
through Google's servers to reach your device. Google processes this data as
our data processor. We retain your token only while the app is installed and
delete it when it is invalidated. For more information see
https://firebase.google.com/support/privacy and
https://policies.google.com/privacy.Adapt this: if you store the token on your backend tied to a user account, say so and note it becomes linked to the user. Add a sentence if you enable the BigQuery delivery export or Analytics notification events. This is not legal advice; you are responsible for accuracy.
App Store "App Privacy" label answers
In App Store Connect, based on the FirebaseMessaging privacy manifest, declare:
- Identifiers > Device ID — the FCM registration token — App Functionality — Not Linked (Linked if you tie it to an account) — Not used to track.
- Diagnostics > Other Diagnostic Data — only if you use topic messaging (device attributes) — App Functionality — Not Linked — Not used to track.
- Usage Data > Product Interaction — only if you enable Analytics notification-open events — Analytics — per your Analytics configuration.
- FCM ships
NSPrivacyTracking= false; do not declare tracking for FCM alone.
Google Play Data Safety answers
- Device or other IDs — Collected: Yes (registration token) — Shared: No — Purpose: App functionality (messaging) — deletion supported (token removed on uninstall or via
deleteToken). - Messages > Other in-app messages — the notification payload — you may mark it "processed ephemerally" because Google routes it transiently to deliver it and does not retain it, provided you have NOT enabled the BigQuery export — Shared: No.
- App info and performance or App activity — only if Analytics notification events are enabled.
- App version and device info for topic messaging — Device or other IDs / App info — Collected: Yes — Shared: No.
Firebase Cloud Messaging (FCM)-specific gotchas
- The registration token is personal data even though it looks anonymous — regulators treat it as an online identifier, so you must be able to delete it on request.
- Tokens rotate. The
onNewToken/ token-refresh callback fires without user action; your deletion and consent logic must handle a changing identifier. - Anything in the notification payload (names, order details, message previews) passes through Google at the application layer — send a minimal payload and fetch sensitive content from your backend.
- "Processed ephemerally" only holds if you have NOT enabled the BigQuery message-delivery export or the Analytics campaign integration; either one creates retained records.
- On Apple platforms the FCM token is derived from the APNs token plus a Firebase installation ID (FID) — deleting the FID or the app invalidates it.
- FCM auto-init runs at app start; set
firebase_messaging_auto_init_enabledto false to hold token generation until the user consents to notifications. - Web push additionally stores a browser push subscription with an endpoint URL on Google's servers.
Related
See the sibling clauses for Firebase Crashlytics, Firebase Performance Monitoring, OneSignal, and Sentry. To assemble these into one document, use the privacy policy page generator or the Firebase privacy policy generator.